This vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 and is characterized by an unauthenticated attacker with network access via HTTP being able to compromise the system. The CVSS 3.1 base score is 8.1, indicating high severity with high impact on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. The vulnerability is listed under CWE-287 (Improper Authentication). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for these specific versions in the provided excerpt.

Successful exploitation can lead to complete takeover of Oracle WebCenter Sites, affecting confidentiality, integrity, and availability of the system. The vulnerability allows unauthenticated remote attackers to compromise the product, which could result in unauthorized access and control.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation status for the affected Oracle WebCenter Sites versions in the provided data. Customers are strongly advised to review the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until patches are confirmed and applied, organizations should consider restricting network access to Oracle WebCenter Sites instances and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.